diff --git a/CMakeLists.txt b/CMakeLists.txt
index e573c15..996eb25 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -35,9 +35,7 @@ if (NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
 endif ()
 
 # These are shared by bddisasm and bdshemu.
-if (MSVC OR "${CMAKE_C_COMPILER_FRONTEND_VARIANT}" STREQUAL "MSVC")
-    set(BDDISASM_COMMON_COMPILE_OPTIONS /W4 /WX)
-else ()
+if (NOT MSVC)
     set(BDDISASM_COMMON_COMPILE_OPTIONS
         "$<$<CONFIG:Release>:-U_FORTIFY_SOURCE>"
         "$<$<CONFIG:Release>:-D_FORTIFY_SOURCE=2>"
@@ -70,6 +68,8 @@ else ()
         -gdwarf-4
         -grecord-gcc-switches
         -march=westmere)
+else ()
+    set(BDDISASM_COMMON_COMPILE_OPTIONS /W4 /WX)
 endif ()
 
 set(BDDISASM_PUBLIC_HEADERS
@@ -91,7 +91,6 @@ set(BDDISASM_INSTALL_INCLUDE_DIR
 
 include(CheckFunctionExists)
 include(CheckSymbolExists)
-include(CheckCCompilerFlag)
 
 add_library(
     bddisasm STATIC
@@ -172,9 +171,7 @@ target_include_directories(bddisasm PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOU
 target_link_libraries(bdshemu PUBLIC bddisasm)
 
 target_compile_options(bdshemu PRIVATE ${BDDISASM_COMMON_COMPILE_OPTIONS})
-
-check_c_compiler_flag(-maes HAS_MAES)
-if (HAS_MAES)
+if (NOT MSVC)
     target_compile_options(bdshemu PRIVATE -maes)
 endif ()
 
diff --git a/bddisasm/bddisasm.c b/bddisasm/bddisasm.c
index 0bd3f48..7abf723 100644
--- a/bddisasm/bddisasm.c
+++ b/bddisasm/bddisasm.c
@@ -3550,7 +3550,7 @@ cleanup_and_exit:
 //
 // NdGetVectorLength
 //
-static inline NDSTATUS
+static __forceinline NDSTATUS
 NdGetVectorLength(
     INSTRUX *Instrux
     )
@@ -3605,7 +3605,7 @@ NdGetVectorLength(
 //
 // NdGetAddrAndOpMode
 //
-static inline NDSTATUS
+static __forceinline NDSTATUS
 NdGetAddrAndOpMode(
     INSTRUX *Instrux
     )
@@ -3636,7 +3636,7 @@ NdGetAddrAndOpMode(
 //
 // NdGetEffectiveOpMode
 //
-static inline NDSTATUS
+static __forceinline NDSTATUS
 NdGetEffectiveOpMode(
     INSTRUX *Instrux
     )
@@ -3792,7 +3792,7 @@ NdPostProcessEvex(
 //
 // NdValidateInstruction
 //
-static inline NDSTATUS
+static __forceinline NDSTATUS
 NdValidateInstruction(
     INSTRUX *Instrux
     )
diff --git a/bddisasm/include/nd_crt.h b/bddisasm/include/nd_crt.h
index 0a97d6e..774aedc 100644
--- a/bddisasm/include/nd_crt.h
+++ b/bddisasm/include/nd_crt.h
@@ -11,6 +11,10 @@
 #define UNREFERENCED_PARAMETER(P)       ((void)(P))
 #endif
 
+#if !defined(_MSC_VER)
+# define __forceinline       inline __attribute__((always_inline))
+#endif // _MSC_VER
+
 // By default, an integrator is expected to provide nd_vsnprintf_s and nd_strcat_s.
 // bddisasm needs both for NdToText, while bdshemu needs nd_vsnprintf_s for emulation tracing.
 // If BDDISASM_NO_FORMAT is defined at compile time these requirements are removed. Instruction formatting will no
diff --git a/disasmtool/CMakeLists.txt b/disasmtool/CMakeLists.txt
index 0e471e2..c8ae37f 100644
--- a/disasmtool/CMakeLists.txt
+++ b/disasmtool/CMakeLists.txt
@@ -27,21 +27,14 @@ if ("${CMAKE_BUILD_TYPE}" STREQUAL "Release")
     endif ()
 endif ()
 
-if (MSVC OR "${CMAKE_C_COMPILER_FRONTEND_VARIANT}" STREQUAL "MSVC")
-    target_compile_options(disasmtool PRIVATE /W4 /WX)
-
-    if ("${CMAKE_C_COMPILER_ID}" STREQUAL "Clang")
-        target_compile_options(disasmtool PRIVATE -Wno-format)
-    endif ()
-else ()
+if (NOT MSVC)
     target_compile_options(
         disasmtool
         PRIVATE -Wall
                 -Wno-unknown-pragmas
                 -Wextra
                 -Wshadow
-                -Wno-format
-                -Wno-cast-function-type
+                -Wformat-security
                 -Wstrict-overflow=2
                 -Wstrict-prototypes
                 -Wwrite-strings
@@ -53,6 +46,7 @@ else ()
                 -Wno-discarded-qualifiers
                 -Wnull-dereference
                 -Wduplicated-cond
+                -Werror=format-security
                 -Werror=implicit-function-declaration
                 -pipe
                 -fwrapv
@@ -65,4 +59,6 @@ else ()
                 -gdwarf-4
                 -grecord-gcc-switches
                 -march=westmere)
+else ()
+    target_compile_options(disasmtool PRIVATE /W4 /WX)
 endif ()
diff --git a/disasmtool/disasmtool.c b/disasmtool/disasmtool.c
index 4084eb2..ab0493e 100644
--- a/disasmtool/disasmtool.c
+++ b/disasmtool/disasmtool.c
@@ -594,7 +594,7 @@ INT32 regstr_to_idx(
         "r8",  "r9",  "r10", "r11", "r12", "r13", "r14", "r15"
     };
 
-    for (INT32 i = 0; i < (INT32)ARRAYSIZE(reg64); i++)
+    for (INT32 i = 0; i < ARRAYSIZE(reg64); i++)
     {
         if (!_stricmp(Reg, reg64[i]))
         {
@@ -1417,7 +1417,7 @@ void set_shemuctx_file(
 
         // first element is the register
         regIdx = regstr_to_idx(regStr);
-        if (regIdx < 0 || regIdx >= (INT32)ARRAYSIZE(Options->ShemuRegs))
+        if (regIdx < 0 || regIdx >= ARRAYSIZE(Options->ShemuRegs))
         {
             if (!_stricmp(regStr, "rip"))
             {